Privacy Policy

Last updated: 18/10/2026

This policy explains what personal data we collect when you visit this website, apply for a training, book a call, buy something or join our newsletter, and what we do with it.

Who we are

Expanded States Academy is run by Aligned Business OÜ, a company registered in Estonia (registry code 17061046, Järvevana tee 9, Tallinn, 11314, Estonia). We are the "controller" of your personal data under the EU General Data Protection Regulation (GDPR).

For any question about your data, or to use your rights, write to Jelena Holodkova at jel@expandedstatesacademy.com.

What we collect

We only collect what you give us or what your browser sends when you use the site.

  • You apply for a training or programme: Your answers in the application form, including your name, email, phone number and background.

  • You book a call or a session: Your name, email, the time you chose and anything you write in the booking form.

  • You join the newsletter or a waitlist, or download a free resource: Your name and email, and which emails you open and click.

  • You pay for a training, session or product: Your name, email, billing details and what you bought. Card details go straight to the payment provider; we never see them.

  • You sign a waiver or give feedback: Your name, your agreement to the waiver terms and any feedback you write.

  • You message us by email, WhatsApp or the contact form: Your name, contact details and what you write.

  • You visit the website: Technical data such as your IP address, browser, device and the pages you visit. Cookies for ads and statistics are only used if you accept them (see "Cookies").

If you choose to tell us about your health, for example before a breathwork session, we use it only to keep you safe and adapt the session, and only with your consent.

Why we use it

We use your data only for the reasons below. The GDPR asks us to name a legal basis for each one.

  • Review your application, talk to you on a call, and run the training or session you sign up for. Legal basis: taking steps before a contract, and the contract itself.

  • Take payments and keep invoices and payment records. Legal basis: the contract, and our legal duty to keep accounting records.

  • Send you our newsletter and news about upcoming trainings and events. Legal basis: your consent. You can unsubscribe at any time with the link in every email.

  • Reply to your messages and questions. Legal basis: our legitimate interest in answering you.

  • Use any health details you choose to share, to keep you safe in a session. Legal basis: your explicit consent.

  • See which ads and pages bring people to our trainings. Legal basis: your consent through the cookie banner.

  • Keep the website working and secure. Legal basis: our legitimate interest in running a safe website.

We do not sell your data, and we do not use it for automated decisions about you.

Cookies

Cookies are small files your browser stores. When you first visit, a banner asks whether you accept them. We only use cookies for statistics and ads if you say yes.

  • Essential cookies keep the site and its security working. They are always on.

  • Statistics cookies (Squarespace) show us how many people visit and which pages they read.

  • Marketing cookies (Google Ads) tell us whether someone who clicked one of our ads went on to apply, book a call or message us on WhatsApp. This helps us spend less on ads that don't work.

If you decline, Google Ads stores no cookies on your device. Google may still receive basic information without cookies, such as that a page was viewed, to estimate how ads perform overall.

When you open the application form or the booking calendar, Typeform and Calendly may set their own cookies, as described in their privacy policies.

To change your choice, clear the cookies for this site in your browser and the banner will show again.

Services we use

We use trusted services to run the website and our trainings. They handle your data on our behalf and only for the purposes above.

If you pay for a private session by bank transfer, PayPal, Wise or Revolut, that provider's own privacy policy applies to the payment.

Data outside the EU

Some of these services are based in the United States or store data there. When your data leaves the European Economic Area, we rely on the safeguards the GDPR allows: the EU-US Data Privacy Framework where the service is certified, or the European Commission's Standard Contractual Clauses.

How long we keep your data

We keep your data only as long as we need it.

  • Applications that don't go ahead: 12 months after the training date, then deleted.

  • Participant records (applications, bookings, waivers): For as long as you're a participant, then 3 years for any questions about your certification.

  • Invoices and payment records: 7 years after the end of the financial year, as Estonian accounting law requires.

  • Newsletter subscription: Until you unsubscribe.

  • Messages: Up to 2 years after our last contact.

  • Cookies: Until they expire or you delete them; Google Ads cookies last up to 90 days.

Your rights

Under the GDPR you can ask us at any time to:

  • see the data we hold about you and get a copy

  • correct data that is wrong

  • delete your data

  • limit how we use it, or object to how we use it

  • send your data to you or to another service in a common format

  • withdraw any consent you gave, without affecting what we did before

Email jel@expandedstatesacademy.com and we'll reply within one month.

If you're not happy with how we handle your data, you can complain to the Estonian Data Protection Inspectorate (aki.ee) or to the data protection authority in the country where you live.

Changes to this policy

We update this policy when we change how we work or which services we use. The date at the top shows the latest version.